Configuring individual interfaces with same parameter on a Cisco Switch can be time consuming.
In order to overcome this you can use following commands,
from the global mode enter config t
then issue interface range fastEthernet 0/1 -24
ITKE(config)#interface range fastEthernet 0/1 -24
Once You enter you should see the below menu and you can use any commands required for the
ITKE(config-if-range)#switchport mode access
Displaying configuration of a single interface can be a time-consuming task if your router or a switch has extremely long configuration. In this case, the interface keyword of the show running-config command becomes extremely useful.
For example, the show running-config interface serial 0/1 command displays only configuration of the specified interface (without building the whole running configuration)
ITKE#show running-config interface serial 0/1
Building configuration…Current configuration : 124 bytes!
description Connected to ISP
ip address 192.168.1.6 255.255.255.248
This article focus on the ways how we can secure SNMP access in Cisco Switches and Routers
Simple Network Management Protocol (SNMP) uses the default UDP port 161 for general SNMP messages and UDP port 162 for SNMP trap messages.
SNMP is a service used to perform network management functions using a data structure called a Management Information Base (MIB). Unfortunately, SNMP version 1 is widely implemented but not very secure, using only clear-text community strings for access to information on the switch, including its configuration file.
If SNMP is not being used, then executing the following commands will disable the service.
Switch(config)# no snmp-server community
Switch(config)# no snmp-server enable traps
Switch(config)# no snmp-server system-shutdown
Switch(config)# no snmp-server
If SNMP is required for a switch or router configure the switch or router for SNMP version 3. This version is more secure than SNMP version 1 because version 3 can use cryptographic hashes for authentication to protect the community string. The above commands for disabling SNMP are recommended for use before deploying SNMP version 3 to remove any possible default community strings. The following commands show an example User Security Model for SNMP version 3 for the switch. The model begins with creating a standard access-list (e.g., 12) that allows only those systems that manage the switch. Next, define a group (e.g., admins) with read and write MIB views (e.g., adminview). Then each user (e.g., root) is added to the group with a password (e.g., 5ecret-5TR1N) that can be hashed (e.g., using md5) before being sent across the network. Also, the standard access-list (e.g., 12) is applied to the user. Finally, the MIB view (e.g., adminview) is defined by one or more statements to include or to exclude portions of the MIB. The MIB view in the following example gives access to the Internet branch of the MIB except the branches that display IP addresses and IP routing information.
Switch(config)# no access-list 12
Switch(config)# access-list 12 permit 10.0.0.2
Switch(config)# access-list 12 permit 10.0.0.4
Switch(config)# snmp-server group admins v3 auth read adminview write adminview
Switch(config)# snmp-server user root admins v3 auth md5 5ecret-5TR1N access 12
Switch(config)# snmp-server view adminview internet included
Switch(config)# snmp-server view adminview ipAddrEntry excluded
Switch(config)# snmp-server view adminview ipRouteEntry excluded
If SNMP is required for a switch and only SNMP version 1 is available, then the following commands show an example of how to configure the switch with a community string (e.g., g00d-5tr1n9) that has read-only permissions and a standard access-list (e.g., 12) applied to it.
Switch(config)# no access-list 12
Switch(config)# access-list 12 permit 10.0.0.2
Switch(config)# access-list 12 permit 10.0.0.4
Switch(config)# snmp-server community g00d-5tr1n9 ro 12
In addition to the configuration of the SNMP service, SNMP Trap information can be sent to the systems that manage the switches. The following commands show an example of this configuration.
Switch(config)# snmp-server host 10.0.0.2 traps g00d-5tr1n9-2
Switch(config)# snmp-server host 10.0.0.4 traps g00d-5tr1n9-2
Switch(config)# snmp-server trap-source Loopback0
Switch(config)# snmp-server enable traps
Finally we are completing this series; here we go with the last topic. It’s Internet Security Policy which is very important to have for any organization. I would welcome your comments which may encourage me to come up with more interesting stuff.
“IS” CONSIDERED THE FOLLOWING:
1. Dedicate a firewall device. Don’t run other services on it, and disable all unnecessary service features that may be included in the firewall package.
2. Disallow all connection attempts to hosts inside the network. Allowing any inbound connections provides a mechanism hackers might be able to exploit to establish connections to Trojan horses or by exploiting bugs in service software.
3. Divide provided services using Internet tools into public services and private (organizational) services. Place the public services on an Internet site (or sites) external to the Internet firewall and provide the private services on an intranet site (or sites) on the protected LAN.
4. Do not rely upon packet filtering alone to protect the network.
5. Do not rely upon Windows ISA Server built-in filtering alone to protect the network.
6. Do not use simple packet filtering or packet-filtering services from the Internet service provider as a replacement for application-layer firewalls. They are not as secure.
7. Don’t rely solely on packet filters for security protection from the Internet. Drop all external routing protocol (EIGRP) updates bound for internal routers. No one outside the network should be transmitting RIP updates to internal routers.
8. Filter out and do not respond to ICMP redirect and echo (ping) messages.
9. Limit the number of external hosts allowed to connect through the firewall to the absolute minimum possible. Take measures to make sure the IP addresses of those hosts are difficult to determine using proxy servers, Firewall or IP masquerades.
10. Make sure there’s no way for a hacker to tell which firewall product is in use.
11. Never publish a list of user or employee names on the Web site. Publish job titles instead.
12. Reduce the number of connections to the Internet to the minimum number possible: one per campus. Many large organizations allow only a single link to the Internet at headquarters and then route all remote offices to that point using the same frame relay lines used to connect internal networks. Respond immediately to intrusion attempts when they are detected. Collect as much information about the attacker as possible. Use their IP domains to determine who the higher-level service providers are.
13. Set up the firewall to discard ICMP echo and to redirect messages to interior hosts.
14. Unbind NetBIOS from all servers outside the firewall. Set the TCP/IP stacks on those machines to accept connection only on ports for services that machine specifically provides.
15. If there is only one connection to the Internet, hard code that connection in the router connected to the service provider’s network. Use RIP, EIGR, OSPF or other automated routing protocols to manage routing inside the network.
16. Do not allow SNMP to travel into or out of the network.
17. Use operating system software on Internet accessible machines that are not susceptible to the Ping of Death.
18. Configure the gateway not to pass Ping packets.
19. Install the latest version of the operating system software.
20. Log network activity and to have the log software signal an alert when a SYN attack or and ICMP flood is in progress. Deny access to the computer or network that originates the attack, and take measures (such as calling or sending an Email message to the administrator of the offending network) to stop the malicious behavior.
21. Un-bind NetBIOS from Internet-accessible network adapters. Allow only authorized hosts outside the network to connect to the DNS servers.
22. Configure the gateway or packet filter to discard all IP packets that use the source routing feature.
23. Disallow services for which there are no proxy servers.
24. Do not allow clear text-password authentication.
25. Do not use RIP or other automated routing protocols. Statically assign the routing tables and disable RIP updates unless the network is too large to manage manually. This makes them impervious to RIP -based denial-of service or spoofing attacks.
26. Don’t allow dial-up connections to the Internet. Remove modems and all other uncontrolled network access devices. Disable free COM ports in the BIOS settings of client computers and password protect the BIOS to prevent users from overriding the security settings.
27. Drop all packets that are TCP source routed. Source routing is rarely used for legitimate purposes.
Log all public access to servers, and check the logs often. Use alerting software to detect hacking attempts against the exposed machines.
28. Set up monitoring software that can alert on flood attacks against the network. Record the IP addresses of the source computers (assuming they look valid) and try to determine the source of the attacks so legal measures can be taken to stop the problem.
29. Set up the own firewall. Place Web and FTP servers outside it and mail servers on the inside. Pass only SMTP and POP3 traffic from external sources. Run no other services or software on mail, Web, FTP, or firewall servers.
30. Use a port scanner periodically (about once a month) from outside the network to check the status of the firewall, packet filter, and NetBIOS bindings. This is especially important when servers are maintained by more than one person or when retaining outsourced security services.
31. Use high-level proxies capable of stripping executable content like ActiveX and Java from Web pages.
32. Use IP masquerades to hide the identity of hosts inside the network.
33. Whenever possible, use proxy servers for all application protocols.
34. Use IP address assignment, in combination with an internal firewall and IP selection on servers, to further control and partition the access allowed to remote users.
35. Use a Web and FTP hosting service rather than computers on the own network to provide the customers with information about the Organization. This puts the Web hosting agency at risk rather than the own network, and allows the provision of no public services from internal servers.
36. As a part of security training, make sure users know to report all instances of denial of service whether they seem important or not. If a specific denial of service can’t be correlate to known downtime or heavy usage, or if a large number of service denials occur in a short time, a siege may be in progress.
37. Great care must be taken when downloading information and files from the internet to safeguard against both malicious code and also inappropriate material.
38. Avoid using one of the smaller Internet service providers. Hackers frequently target them as potential employers because they often have less security awareness and may use UNIX computers, rather than dedicated machines, as gateways and firewalls-making spoof attacks easy to perpetrate. Ask the service provider if they perform background checks on technical service personnel, and reject those that say they do not.
39. Consider using the disconnected Internet security model if the services required by the users can be made available from a single machine.
40. Manually assigning IP addresses if the Organization is a potential espionage target.
41. Apply the anti-spoofing filter.
42. Plans are to be prepared maintained and regularly tested to ensure that damage done by possible external cyber crime attacks can be minimized and that restoration takes place as quickly as possible.
43. In order to reduce the incidence and possibility of internal attacks, access control standards and data classification standards are to be periodically reviewed whilst maintained at all times.
44. Contingency plans for a denial service attack are to be maintained and periodically tested to ensure adequacy
45. Procedures to deal with hoax virus warnings are to be implemented and maintained.
46. Antivirus software is to be deployed across all PCs with regular virus defining updates and scanning across servers, PCs and laptop computers.
47. E-commerce processing systems including the e-commerce Web site(s) are to be designed with protection from malicious attack given the highest priority.
48. E-commerce related Web Site(s) and their associated systems are to be secured using a combination of technology to prevent and detect intrusion together with robust procedures using dual control, where manual interaction is required.
49. Personnel should understand the rights granted to them by the Organization in respect of privacy in personal e-mail transmitted across the Organization systems and networks. Human Resources Department should incorporate a suitable wording into employee contracts to ensure that this privacy issue is fully understood.
50. Confidential and sensitive information should not be transmitted by-mail unless it is secured through encryption or other secure means.
51. E-mail should be considered as an insecure communications medium for the purposes of legal retention for record purposes. With the usage of digital signatures and encryption, reliance upon e-mail may soon be available; however, if in any doubt, treat e-mail as transient.
52. External e-mail messages should have appropriate signature footers and disclaimers appended (E-mail Signature File). A disclaimer is particularly important where, through a miss-key, the email is sent to an inappropriate person. The disclaimer should confirm the confidential nature of the email and request its deletion if the addressee is not, in fact, the intended recipient.
53. Personnel should not open e-mails or attached files without ensuring that the content appears genuine. If you are not expecting to receive the message or are not absolutely certain about its source do not open it.
54. Personnel should be familiar with general e-mail good practice e.g. the need to save, store and file e-mail with business content in a similar manner to the storage of letters and other traditional mail. E -mails of little or no organizational value should on the other hand be regularly purged or deleted from your system.
55. Use standard TEXT (ASCII) messages where possible; these are both smaller (in terms of file size) and are less able to ‘hide’ executable code e.g. HTML based e-mails which can ‘run’ upon opening.
56. The sending of inappropriate messages should be prohibited including those which are sexually harassing or offensive to others on the grounds of race, religion or gender.
Today after a good weekend when I came back to my office, I figured out two our switches has problems with the redundant links. It would have consumed more time if I had no proper documentation. With time and experience I learnt that it is must to have good documentation about the Network.
In order to monitor the links I simply use What’s Up Gold from IP Switch. I have documented our network using Microsoft Visio with interface details, IP address details for each Switch . Since all the connection details were documented it was pretty easy for me to identify the port number in the core switch and to check the log what happened. One of the problems we faced was a defective fiber patch cord and other problem was a defective SFP module. Upon changing these two things we could able to fix this problem in matter of five minutes.
In our organization internet management was a big issue, since we had no budget allocated to Internet management I was worried? How should I control our internet usage? Tried to convince the management to buy content filtering appliances, unfortunately they had no budget and our users had no control and they were enjoying the freedom of internet. I started looking for open source appliances and came across Untangle. Which proved to be great for us to control our users? (Who were not happy)? By installing this open source network gateway we could manage to block most of the unwanted contents, P2P applications and much more.
What is Untangle?
Untangle is a privately held company that provides an open source network gateway for small businesses. Untangle provides many gateway applications, such as blocking spam, blocking malware, web filtering, phishing protection, intrusion prevention, and more  on the Untangle Gateway Platform.
Untangle was founded in 2003 as Metavize, Inc. by John Irwin and Dirk Morris. Metavize officially launched in 2005 at Demo@15!. In 2006, Metavize raised a $10.5M series-A venture round from CMEA Ventures and Rustic Canyon Partners, named Bob Walters as CEO, and renamed to Untangle, Inc. In 2007, Untangle released the Untangle Gateway Platform as open source under the GPLv2 license .In 2007, Untangle also experienced significant growth and surpassed 100,000 users in 2,000 organizations
Some of the features available with Untangle are as follows
· Spam Blocker
· Spyware Blocker
· Web Filter
· Virus Blocker
· Phish Blocker
· Protocol Control
· Intrusion Prevention
· Attack Blocker
· Untangle Reports
Untangle can be installed easily on any pc and its ready use. You can download Untangle from following link http://www.untangle.com/index.php?option=com_content&task=view&id=226&Itemid=739
The minimum hardware requirements to install untangle are as follows
|CPU*:||1.0 GHz||2.0 GHz|
|Memory:||512 MB||1-2 GB|
|Hard Drive:||20 GB||40 GB|
|Network cards:||2||3 (for DMZ)|
Untangle can also be installed in VMware platform do follow this link for more details http://wiki.untangle.com/index.php/Untangle_Virtual_Appliance_on_VMware
In order to know about the supported configurations do access http://wiki.untangle.com/index.php/Introduction#Supported_Configurations
Further details can be found at the following links
Finally we are almost proceeding towards the completion of the Sample I.T Security policy, we have just two more topics to cover. Coming days I will try to complete that, here we are with Remote Access Security
REMOTE ACCESS SECURITY
“IS” CONSIDERED THE FOLLOWING:
1. RAS server provides the most secure method for remote access to the network if it is reburied.
2. Never allow client computers on the network to answer remote access connections.
3. Organize all remote access servers in a centrally controlled location.
4. Servers have no need to originate dial-out connections (Except when using telephone lines as low cost WAN connections, but these connections should be relatively permanent).
5. To simplify security administration, allow only one method of remote access into the network.
6. Remote access control procedures must provide adequate safeguards through robust identification, authentication and encryption techniques.
7. Carefully consider the wisdom of providing cellular telephones and modems for use with laptop computers. This technology isn’t usually justified considering the relatively modest increase in productivity compared to the cost and the security risk of a lost laptop.
8. Consider using only the NetBEUI protocol for remote access to limit the extent of intrusions on the network.
9. Control the distribution of remote access software on the network. Never allow client computers to run remote control software. If remote control software is necessary, run the software from centrally controlled computers or thin-client servers.
10. Disable dial-in networking, except in the cases of trusted individuals or to special computers,because dial-in networking can bypass regular network security.
11. Encourage an easy-to-use (but secure, of course) method for users to indicate when they need remote access, for how long, and to which phone number. Base the dial-in permissions on these requests. Always verify the request verbally with the user to ensure that it’s not a spoof.
12. Gather contact information for the telephone companies as soon as possible so that it is on hand if dial -up hacking attempts are discovered.
13. If possible, use external modems to answer RAS connections. They can be powered off when no RAS activity is anticipated, and they allow manual disconnection if necessary.
14. If remote access is required only occasionally, set the Remote Access Server service to start manually, then use the services control panel to start the service when needed and stop it when it is no longer in use.
15. Revoke dial-in permissions for users during periods when they are not necessary, and invoke them when the user is away from the office or working from home for a period.
16. Thin client and remote control software can be more secure than remote access software in certain circumstances. For instance, an entire database could be copied down using remote access software, but that same data would be extremely difficult to extract using remote control software configured to disallow file transfers.
17. Tightly control user-based remote access permissions. Allow only those users who have an immediate need to log in remotely.
18. Use alarming software to detect numerous attempts at password guessing over dial-up networks. Use the standard performance monitor to detect this activity, or purchase third party alarming software.
19. Use callback security. Without callback security, tracing RAS based intrusion attempts is very difficult.
20. Use external modems that have on/off switches for those machines that have remote access software installed. Only turn on a modem when a user calls in and requests a remote control connection.
21. Use hard-coded callback security for all remote users that don’t normally travel, to prevent their account from being exploited from unknown locations.
22. Use Microsoft encryption when possible.
23. Use the Point-to-Point Tunneling Protocol for all Internet connections allowed into the network, or some third-party software that performs the encrypted tunnel function in concert with the firewall.
I was just browsing Cisco website and figured out Cisco happens to be the first company to achieve the new certification, Certified Green by Miercom. Just to brief you about Miercom is a leading network product test center and consultancy firm.
The Certified Green program is based on detailed lab test results and qualitative product assessments, and is designed to provide meaningful, independent guidance to IT organizations looking to improve their own Green IT and business practices.Yet another mile stone Cisco achieved. Currently following Cisco® Catalyst® 3750-E, 3560-E, 3750, 3560 and 2960 Series Switches are designated as Certified Green.
More details can be accessed from the press release http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps7077/Miercom_Certified_Green_Press_Release_-_FINAL_as_at_4-28-08.pdf
[kml_flashembed movie="http://www.youtube.com/v/d4RobLgxc30" width="425" height="350" wmode="transparent" /]
Here in this example I am going to show you how to restrict the web access to any Cisco IOS Switch or Router.
If web-based administration of the switch is necessary, then restrict HTTP access to the switch.
Configure a standard access-list (e.g., 11) that allows only the administrators’ systems to make these connections and apply this access-list to the HTTP service on the switch. Finally, use the ip http authentication local command to enable local account checking at login that will prompt for a username and a password.
Switch(config)# access-list 11 remark Permit HTTP access from administrators’ systems
Switch(config)# access-list 11 permit host 10.0.0.2 log
Switch(config)# access-list 11 permit host 10.0.0.4 log
Switch(config)# access-list 11 deny any log
Switch(config)# ip http server
Switch(config)# ip http access-class 11
Switch(config)# ip http authentication local
Note that the web browser used for administration will cache important information (e.g., passwords).Make sure that the cache is emptied periodically.
Personel Web Site:www.yasirirfan.com<p
Other Day I was in a seminar Data Center Stratergy 3.0 organised by Cisco.Leading local industry pundits attended this seminar and it was a simply great. Cisco officially launched Nexus 5000 in this part of the region. There were some good presentations and case studies on Nexus 5000.
Well the intresting part was some of the partners presentations. Among them Panduit came up with some great products which I would like to share with you all.
Panduit designed an exclusive 45 U cabinet exclusively for the Nexus 7000 series Switch. This cabinet kit enhances interoperability, reduces installation time and supports the performance need s of Data Center. More details can be access from their website ttp://www.panduit.com/Products/ProductOverviews/ProductSearch/index.htm?Ne=1&N=5000001%201473%203004292&lastNodeId=ss_prod_cabinetsrackscables&R=CN1&sid=11AD24324688.
One more interesting thing Panduit came up is the fiber runner. This offers complete fiber cable routing solution to Data centers, it’s modular and can be installed in few minutes. It’s easy to manage and install. Do have a look at this video
[kml_flashembed movie="http://www.youtube.com/v/Amzh1x-Hya4" width="425" height="350" wmode="transparent" /]